Aircraft Accidents and Lessons Unlearned XXXIV: Avianca Flight 52

Avianca 52 laying against a hillside in Cove Neck, NY

On July 19, 1989, at 2134 (9:34 PM) eastern standard time, an Avianca Airlines Boeing 707-321B, flight 52, which originated in Bogota, Colombia, enroute to JFK Airport, crashed almost twenty miles northeast of the airport. The aircraft, mechanically sound, crashed due to fuel starvation. The airliner ran out of fuel.

The National Transportation Safety Board (NTSB) determined in accident report AAR-91/04, “… the Probable Cause of this accident was the failure of the flight crew to adequately manage the airplane’s load, and their failure to communicate an emergency fuel situation to air traffic control before fuel exhaustion occurred. Contributing to the accident was the flight crew’s failure to use an airline operational control dispatch system to assist then during the international flight into a high-density airport in poor weather.” The other contributing factor should have come as no surprise since the NTSB uses the same “cause” in all major accidents: “… contributing to the accident … was the Federal Aviation Administration (FAA)”

The NTSB entered unchartered waters with Avianca 52. They approached this accident with little regard for what was important in the understanding of what happened or what the consequences were for getting the investigation wrong. This was the first tragic event that challenged, indeed called attention to, decades old Annexes created in the Chicago Convention of 1944.

At this time, I would like to thank my friend Oscar, who is my guru for all things International Civil Aviation Organization (ICAO). He used this accident in class as a case study to those understanding international aviation issues. There were three take-aways from the Avianca 52 that the FAA and ICAO put into place:

1 – The FAA International Aviation Safety Assessment (IASA) Program, which determined the quality of a foreign country’s oversight of air carriers operating inside another country, e.g. AVIANCA operating in the United States, and whether, e.g. Colombia’s oversight agency followed the safety standards of ICAO. This led to the development of ICAO’s Universal Safety Oversight Audit Program (USOAP), a means to audit aviation safety oversight, with scheduled and mandatory audits of ICAO States’ (Countries) safety oversight systems.

2 – Improving English language requirements for international flights as per ICAO Annex 1. English language has always been the universal language of aviation since the Chicago Convention in 1944; the cockpit voice recorder transcript demonstrated a breakdown in communication.

3 – The pushing of ICAO Article 83 bis. This was an amendment to the 1944 Chicago Convention and finally addressed issues that, in 1944, were unexpected with international travel. It allowed for specific oversight responsibilities be transferred between two States (Countries): the State (Country) of Registry and the State (Country) the aircraft is operating inside of. This allowed, not only provided for continuous oversight in foreign countries for airlines, but it would eventually include repair stations.

In the time between the accident and the NTSB report, Congressman Jim Oberstar (D-MN), Chairman of the House Transportation Committee (HTC), called then Associate Administrator in the FAA, Anthony Broderick, before the HTC to answer questions about what the FAA did to ensure foreign operators flying within the US were safe. Broderick’s response was that each State (Country), if they are ICAO members, has a Civil Aviation Authority (CAA), which had oversight to ensure the various foreign operators flying in the US were safe. The FAA had no authority over another country’s CAA; that the FAA was not authorized to audit a foreign CAA for compliance with ICAO standards. Avianca fell under the oversight of Colombia’s CAA.

HTC Chair Oberstar did not like that reply; he told Broderick to come back with a better answer.

What resulted was that Broderick took a team to other CAA offices around the world, armed with knowledge of the Air Transport Agreements’ Language, and one-by-one talked to each of them to determine the quality of oversight each provided to its operators in country and thus a better understanding of how they conducted oversight in other countries. The results were not promising; one CAA did not even employ Operations inspectors to oversee pilots, flight training, etc.

Broderick then put in work a program to ensure foreign operators had effective CAAs with qualified Airworthiness and Operations inspectors or they could not fly into the US. Under the International Aviation Safety Assessment (IASA) Program, the FAA could now ascertain another country’s quality of air carrier oversight; the FAA could now determine if the international CAAs were complying with ICAO’s 12,000 International Standards and Recommended Practices, especially those found under Annex One (Personnel Licensing), Annex Six (Operation of Aircraft) and Annex Eight (Airworthiness of Aircraft). Airlines that were assessed were those who had filed an application with the US Department of Transportation for a foreign air carrier permit, such as Avianca.

If the foreign CAA met ICAO standards, the air carrier was granted a Category One authority by the FAA. This allowed the air carrier from the assessed State (Country) to either initiate service within the US or continue to provide service into the US.

How did the NTSB miss this; why was this not in the report? Simply put, the NTSB did not do its homework. They did not try to understand the complexity of a foreign operator conducting service inside the US. The NTSB assumed the whole time that the FAA had authority, when it did not. The NTSB assumed that foreign CAAs’ oversight of air carriers was up to the standards of the FAA, which they were not. The Chicago Convention of 1944, the origin of ICAO, had taken place over forty-five years before, in the days of post-war, propeller-driven passenger airliners. The international aviation world’s perceptions of international travel were in desperate need of change.

It was unfortunate that this opportunity was squandered, this chance to generate positive change. It was a tragic opportunity that the aviation community did not wish to repeat in order to relearn what was missed with Avianca 52.

Yet, there was one more missed opportunity that was wasted, which was the pursuit of the Root Cause. All investigatory efforts were focused on the Avianca 52 flight crew’s poor command of the English language – their conversations sounded confused. The focus was on the desperation of flying with no fuel – a truth that was undeniable. The investigation, like a poor marksman, kept missing the target: Root Cause. What happened one hour and seventeen minutes before the crash, well before the fuel tanks went dry, well before things went south as the window of opportunity continued to narrow?

The answer will never be known because the question was never asked. Why did the crew not divert to Boston a half hour earlier? As the fuel fell to a decision-point level, what person – or persons – made the decision to stay in a holding pattern over Long Island? Didn’t one of the pilots argue to fly to the diversion airport? Was the culture inside the cockpit conducive to discussion or was the captain unshakeable? Was the airline responsible for driving the crew to land at JFK at all costs?

Culture continues to overpower common sense. Accidents such as Air Florida 90, Asiana 214, Lion Air 610 and Air France 447; each a tragic event where a sound aircraft was flown into the scene of the accident by indecision and poor communication skills. Cultural influences that caused Air Florida 90 only a few years prior to Avianca 52 were, and still are, an unknown, treated by the aviation community as a myth; an old wives’ tale akin to gremlins and the Bermuda Triangle.

It is past time the NTSB takes ‘culture’ seriously. Accidents, like Avianca 52, demonstrate that fifty-three years of the NTSB’s business-as-usual investigatory practices need to enter the twenty-first century; they need to embrace the reality of cultural divides within the industries they investigate. But industry is not hopeful; with apologies to Abba Eban, the NTSB “never misses an opportunity to miss an opportunity.”

Aircraft Accidents, Rip van Winkle and Longevity

Rip van Winkle, the idle protagonist of Washington Irving’s short story of the same name, went to sleep against a tree and woke up some twenty years later. He was rewarded from his extended slumber with two realities: he missed twenty years of progress (he slept through the Revolutionary War) and his lack of awareness was viewed as senility when he claimed loyalty to King George III. What a conundrum.

Have you ever heard on the news about ‘length of government service’ of any individual, say, of Congress or Presidential candidates? Perhaps one government employee had thirty years of continuous government service in the Senate while another one had forty-five years. How does that work? Does political office make one wise? Do they become closer to their constituents without having to rub elbows with them? Or do they just adopt a ‘know-better’ attitude and plod on, ignorant of the world around them?

Government service can be a respectable career. Take the brave servicemen and women who protect our nation, their diligence and dedication are of the highest degree. They devote their careers to us; they constantly revise their skills, learning to counter the latest national threats, adapting to remain proactive. They are constantly challenging themselves to be prepared for what comes next, physically, emotionally and/or technically. They are a branch of government that serves as a lesson in progress and awareness. On the local level, firefighters, emergency responders and police do the same to remain consistent and up to date, to protect themselves and others under their watch.

However, not all public servants are such as these. As one enters political government service, one is often removed from their constituents, just as Rip’s nap separated him from his community. Public servants become ignorant during their time in office. To be effective, a public servant must revisit the culture that led to their office term, they must re-identify with the constituency. If not, they take the chance of becoming obsolete, pariahs. Thirty-five years of driving a computer – don’t forget, that would include several years of driving a typewriter – does not an expert make. However, in truth, the level of obsolescence would depend on the government job and the qualifications for that job.

How would a thirty-five-year veteran of the aviation safety agencies, fare?

The Federal Aviation Administration (FAA) is the governmental agency dedicated to aviation, period. The National Transportation Safety Board (NTSB) is the governmental agency dedicated to improving transportation safety by investigating transportation incidents and accidents. The thirty-five-year (1985) veteran of the FAA or NTSB may be administrative. As Napoleon Bonaparte – or was it Frederick the Great(?) – once stated, “An army marches on its stomach,” which spoke to the soldiers’ need for provisions. It could be restated that the FAA, “marches on its records.” Therefore, the oversight agency relies heavily upon the office staff – not aviation-experienced inspectors – but those who work in the background and have organizational skills. These people, who are too often overlooked, are the lifeline of the FAA. Thirty-five years of administrative duties is an honorable occupation, a worthy goal.

However, the mission of the FAA is not restricted to the office; their responsibilities extend to the field, a field that separates experience from ‘checking a box’. The FAA aviation safety inspector (ASI) must have experience from the industry to understand the industry. The ASI must know what he or she is saying and what he or she is looking for to be effective.

What if the FAA hired ASIs with no field experience, like Operations ASIs with nothing more than a private pilot’s license? What if FAA Airworthiness ASIs were newly graduated from an airframe and powerplant school, never having ‘turned a wrench’ or changed a tire? A thirty-five-year career with no previous experience would be pointless. Would a B777 captain benefit from an Operations ASI with no experience? What about the Airworthiness ASI who is a mechanic-in-certificate only? What if either one of these ASIs were responsible for developing training, making policy or writing regulations? What would these ASIs draw from to oversee the industry? Would they make aviation safer? Think of the retirement speech, “Thirty-five years of … YOU, not knowing what you were talking about! Yay!”

Fortunately, the FAA only hires industry-experienced ASIs to conduct oversight; these ASIs have a stake in the game they are involved in – aviation safety. Working closely with industry, the FAA ASI’s thirty-five years of experience would have evolved with the industry. Operations ASIs would have regularly interacted with pilots of all kinds; been familiar with a certificate holder’s equipment and were involved in their training, first-hand. Airworthiness and Avionics ASIs worked closely with the certificate holders’ approvals, on-site inspections, learning the equipment, first-hand. Yet being a thirty-five-year FAA ASI veteran, would not guarantee success, especially if the ASI did not consistently evolve at the pace the industry did. The diversity of the industry will always surprise – with devastating results – many ASIs who underestimate an industry too headstrong to be contained. The evidence can be found in numerous accident reports – only if one has the common sense to learn the Root Causes.

Thirty-five years ago, digital aircraft had barely dawned; composites were the up-and-coming technology; the industry, today, stands close to commercial space flight as a reality. Technology, in thirty-five years has been meteoric and it will not stop. Since 1985, the thirty-five-year FAA veteran has grown with the industry, learned and been challenged by the industry. It has been thirty-five years well spent.

What about the NTSB thirty-five-year veteran?

In 1985, a digital aircraft was the exception, not the norm. Stage III Noise Standards were still ten years away; structural inspections were beginning to extend older aircraft. From 1985 to the mid-90s, an NTSB investigator would not have experienced, e.g. advanced digital instrumentation, fly-by-wire, NextGen, composites, Full Authority Digital Engine Control, aka FADEC, horizontal stabilizer fuel tanks, heavy airliner two-man cockpits, and the expansion of both International and Domestic Repair Stations. And the NTSB investigator never would. NTSB investigators never directly engage with industry.

Would the average NTSB aircraft-specific investigator (Systems, Engines, Maintenance and Structures) be familiar with the wear-and-tear of the average aircraft? That would depend: is the NTSB aircraft-specific major accident investigator an engineer or a maintenance technician? A technician would have worked the entire aircraft throughout his career; he would have worked different aircraft models and understood airline culture. An engineer would have designed one minuscule part of an aircraft.

Would engineers who designed Water/Waste systems understand Pneumatic overtemperature sensors? Can communications engineers comprehend Wing Anti-ice systems? How would an engineer who designed engine generators understand fuel-driven variable stator vanes? How many NTSB aircraft-specific major accident investigators are engineers? According to the NTSB’s Human Resources department: all aircraft-specific major accident investigators investigating any air carrier accidents are engineers. They have no career knowledge/experience about the industry or the aircraft they investigate.

The FAA has no engineer ASIs; no FAA engineers conduct industry oversight where Maintenance is a crucial issue. Why wouldn’t the NTSB have experienced maintenance technician accident investigators? Why does the NTSB rely on inexperienced engineers who have never known troubleshooting, maintenance cultures, training, or aging aircraft? NTSB engineers have been sheltered from the industry’s technological progresses for decades. Who in the NTSB was qualified with the technological knowledge to understand the B737-MAX avionics issues? National Air Cargo 102’s floor failure? Emery 17’s maintenance culture? Air Midwest 5481’s multiple procedural and regulatory errors? The numerous other accidents where maintenance and technology played a major role? With inexperienced engineers as investigatory group leads, can the NTSB successfully investigate any major accident?

Rip van Winkle was a short story with a clear message: if you separate yourself from your surroundings, you hobble your effectiveness; the world goes on without you; you become – obsolete. The good news was that Mister Winkle had experienced life with memories; he soon saw what his nap had done to him upon waking. What if good ol’ Rip had never had the experiences of a life to begin with? Then he would have been better off staying asleep on the mountain. He would have had nothing to contribute.

Aircraft Accidents and Lessons Unlearned XXXIII: Swissair Flight 111

Swissair MD-11 in reconstruction

On September 2, 1998, fifty-three minutes after departing JFK International Airport for a scheduled flight to Geneva, Switzerland, Swissair flight 111, a McDonnell-Douglas MD-11 aircraft, registration number HB-IWF suffered the first indications of an onboard fire. About twenty minutes later, while executing an emergency landing in Halifax, the airliner crashed into Peggy’s Cove, Nova Scotia, Canada. Approximately seven minutes before impact, both the flight data recorder (FDR) and the cockpit voice recorder (CVR) ceased functioning; all radio communications and secondary radar contact were lost. It would remain unknown what the last minutes in the flight compartment were.

The Transportation Safety Board (TSB) of Canada led the investigation; they followed International Civil Aviation Organization (ICAO) Standards and Practices Annex 13. The accident report, A98H0003, demonstrated a call to a higher quality accident report. It did not conclude on the ambiguous ‘probable cause’ but instead the TSB relied on root causes to dig deeper, to find the cause to the cause; the fundamental lessons to be learned. Although it referred to the need for unnecessary changes and technologies, such as cockpit video cameras and other irrelevant fixes, the report stayed the course and delivered on the root problems that made the industry aware of its technological ignorance and the need to catch up in a fast-paced rush for digital improvements that were leaving engineers behind.

The MD-11 was one of the first airliners to mainly employ digital technology. These ‘fly-by-wire’ systems were/are just that: wires replaced the heavy cable systems for flight controls, shrank the size of actuators, employed lighter composite materials and reduced the gauge (wire diameter) of wires that handled lower current wires than their predecessors. This reduced the airliner’s weight and increased efficiency. However, there are always trade-offs; ‘fly-by-wire’ also established a new learning curve for pilots, mechanics and engineers, a curve that did not follow the rules of earlier ‘analog’ aircraft.

Both the FDR and CVR ceased to function well before the crash occurred; each circuit breaker (CB) was close in proximity to the fire, which was a main contributor. The loss of both recorders presented the TSB with a unique problem: how to determine what the flight crew spoke of in the cockpit and what the various control inputs were during the last minutes of flight. The recorders are considered by all accident investigators to be a most important tool.

However, CVRs can become a crutch; a double-edged sword that works against common sense, as seen in the National Air Cargo 102 accident report, AAR-15/01. The correct analysis of the CVR depends heavily upon those who interpret the recorder. In emergency events, words are garbled, distorted inside the oxygen mask; pilots talk over each other or alarms drown out important conversation. FDR information can also be confused when determining what control inputs were the pilots’ and what was caused by the aircraft’s confused signals. The effectiveness of both recorders is also dependent upon power being supplied, constantly. In Swissair 111, it appeared that both recorders suffered failures due to power cut-outs to the recorders themselves.

A primary cause of the in-flight fire that doomed Swissair 111 was determined to be a recently installed In-Flight Entertainment Network (IFEN) into the cabin electrical bus; the IFEN was added post-manufacturer as part of a supplemental type certificate (STC), an engineering design that allows modifications and improvements to an aircraft. While one of the major contributors was location, the most influential cause was the flight crew’s inability to disable the IFEN system, indeed their being unaware the IFEN was not disabled when they deactivated the cabin electrical bus. All systems are designed, per regulation, to be disabled by the flight crew in flight. The IFEN system defied this design.

A second cause was the use of metallized polyethylene terephthalate (MPET) type-acoustical blankets, used to ‘quiet’ airstream noises. The MPET blanket and other materials behind the CB panels were flammable and in close proximity to the CB wiring. These materials did not meet the fire-preventive requirements for the aircraft and contributed to the fire propagation. The CBs used in the STC installation were not capable of protecting against wire arcing events, which contributed to the start of the fire. These hazards also led to a loss of digital instruments vital to aircraft control.

The IFEN, “design, certification, installation, testing and operation presumed that the ‘non-essential, non-required’ designation [of the STC] confirmed that whether failing or operating normally, the IFEN installation would have no adverse effect on aircraft cockpit operations.” This meant that the STC planned for the IFEN system to not become a hazard to the electrical system. However, the STC did not account for the IFEN remaining powered when selecting the CABIN BUS switch to off [powering OFF the cabin electrical bus]. This was a result of poor engineering; the IFEN system remained powered.

The circuit protection for the IFEN was located in the Upper and Lower Avionics (UAL) CB panel, to the right and aft of the First Officer’s seat. The CBs for many flight control, flight attitude, communications and other critical systems, including the FDR were routed to the UAL panel. In addition, wire bundles coming off the UAL panel and other nearby electrical controls were routed behind or in close proximity to the UAL panel.

Wire bundles are comprised of dozens of angel hair sized insulated wires bound together so as to be routed through the structures behind the panels. Individually or as a group, these wires have a low resistance to the effects of heat, which affect their resistance. Overheated, the wire can allow too much current to the circuit, where the CB breaks the circuit shutting off power to the system it protects. Heat can also damage the integrity of the wire permanently.

The TSB found in their report under Limitations of FAR 25.1353 Electrical Equipment and Installations, that separation of the wire bundles behind the CB panel were, per their analysis, inadequate; heat generated behind the CB panel was not evacuated properly. The Flight Crew Reading (Map) Light also was given considerable attention as during other MD-11 inspections, there were problems discovered with the light and the insulation blanket installed behind. Although this was a good find, the map light did not contribute to the fire. Instead, the attention dedicated to the map light occupied three pages of the report and, with other unassociated topics, acted as a distraction to the report’s findings. It would have been better addressed at the report’s conclusion.

What led to this accident were two simple mistakes. The first was an STC was generated and its contents were used to install an IFEN system in the airliner, in fact several sister ships, that did not deenergize a system when selected OFF. Its root cause was the inexperience of the engineer(s) writing the STC with the peculiarities of digital aircraft as opposed to analog. This problem was not limited to digital technologies introduced with airliners like the MD-11; it was also a major upset with composites, lighter metals and the tasks once handled by the second officer. The learning curve was extensive, not only in Operations and Maintenance learning the new aircraft, but it also took years to get airliners like the MD-11’s reliability to where it should be, what the manufacturer advertised it as.

The second root cause was McDonnell-Douglas’s use of MPET insulation blankets and ventilation of heat behind the CB panels. These errors allowed arcing and prevented heat removal that acted together to create a safety hazard.

While the second root cause was more easily rectified with a change in parts; the first was not. For years design flaws were built into aircraft by airliner manufacturers, e.g. Turkish Airlines 981, and/or the modifications found in STCs and other devices of change, as found in the LAS DC-9 accident in Mitu, Colombia in 2003. These are two examples that, without proper research, led to catastrophic events. It is (and was) the responsibility of the Federal Aviation Administration (FAA) to keep a tight grip on engineering. The Swissair 111 tragedy was due to misses on the FAA’s watch. The misses continue because inadequate attention was given in this and other reports to the research needed in correctly writing STCs. However, the new territory of digital was also found to be entered into too quickly.

Swissair 111’s report, bought at a heavy cost, should have been an example of investigatory superiority. Its attention to detail and search for root cause should have been representative of where accident investigation needed to be.